CVE-2017-1000480

CVE-2017-1000480 is a critical PHP code injection vulnerability affecting Smarty 3 versions prior to 3.1.32. This flaw allows an attacker to inject and execute arbitrary PHP code by exploiting unsanitized template names when calling fetch() or display() functions on custom resources. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the high severity warrants immediate patching.